Screen OS

Could someone confirm if there is a max number of VIP you can create on a SSG5? If yes do you know what that magic number would be per interface.

Thank you,

Hi,

Use the following command to find out

get sys-cf | include vip

This should give you the max number for that platform.

If you are running out you could use NAT-DST, which does the same thing as VIP.

Hope this helps

Regards

Andy

I believe the max is 64 per device, not interface.

The one place where VIP differs from DST-NAT is the ability to NAT a dynamic untrust interface IP.  This is needed if you need incoming NAT on a home "DSL" or Cable type connection.

1. This KB article lists the maximum per device:

KB5989 - Maximum number of VIP, MIP, and DIPs supported on different platform for ScreenOS

2. Also, Dan has a good point. Here's an excerpt from ScreenOS Cookbook:

VIPs come with many caveats. The most important is that VIPs before ScreenOS 6.1 can exist only on interfaces in the Untrust zone and must be in the same network with that interface. Policy NAT-DST offers much greater flexibility. But what a VIP can do and policy NAT-DST cannot do is use the firewall's own public IP address for translation.

"This exerpt is used by permission of the publisher, O'Reilly Media, © 2008. All rights reserved. Excerpted from ScreenOS Cookbook, by Stefan Brunner, Ken Draper, David Delcourt, Joe Kelley, Vik Drakar, & Sunil Wadhwa. ISBN: 0596510039."

3. This is also helpful on the difference with VIP and NAT-DST: J-Net thread on VIP and NAT-DST

Hope that helps.

Josine